check-boundaries

check-boundaries is a command for coding agents from pruthvinathJV/nextjs-claude-code-kit. It costs 0 tokens per session (482 once invoked), scanned A, original, MIT.

A review command for React component trees, which are the nested pieces that make up a React interface. It checks whether “use client” directives are needed.

In plain words
What is it for?
Use it to find unnecessary client directives, recommend server components, and identify small interactive parts that should be separated.
Why use it?
It identifies components marked for browser-side rendering even though they may not use browser features or interactive state.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/pruthvinathjv/nextjs-claude-code-kit/check-boundaries
Clone the repo
git clone --depth 1 https://github.com/pruthvinathJV/nextjs-claude-code-kit

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for check-boundaries

README.md
[![agentmods](https://agentmods.dev/badge/commands/pruthvinathjv/nextjs-claude-code-kit/check-boundaries.svg)](https://agentmods.dev/commands/pruthvinathjv/nextjs-claude-code-kit/check-boundaries)
Your own site
<a href="https://agentmods.dev/commands/pruthvinathjv/nextjs-claude-code-kit/check-boundaries"><img src="https://agentmods.dev/badge/commands/pruthvinathjv/nextjs-claude-code-kit/check-boundaries.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 482 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00482
Opus 5 $0.00000 $0.00241
Sonnet 5 $0.00000 $0.00096
Haiku 4.5 $0.00000 $0.00048

Measured 4d ago against content hash 984ea75393bf, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

check-boundaries scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/check-boundaries.md · 36 lines

What it actually says

Review the component tree in $ARGUMENTS for incorrect or unnecessary 'use client' directives.

For each component file found:

  1. Check if 'use client' is present

  2. If yes, verify it is actually required by checking whether the component uses:

    • Browser APIs (window, document, localStorage, sessionStorage)
    • Event handlers that require client state (onClick with useState, onChange with controlled inputs)
    • React hooks that depend on client state: useState, useEffect, useReducer, useRef for DOM manipulation
    • Client-only third-party libraries
  3. Flag as INCORRECTLY CLIENTED if 'use client' is present but the component:

    • Only renders JSX with no interactivity
    • Only passes props down to child components
    • Does data fetching that could be done in a Server Component
    • Has 'use client' because a child needed it (the child should have it, not the parent)
  4. For each incorrectly cliented component, suggest the fix:

    • If the component itself needs no client features: remove 'use client', make it a Server Component
    • If only a small part needs client features: identify which piece to extract as a separate Client Component
  5. Check for the anti-pattern where a large Server Component was converted to a Client Component just to pass an event handler — suggest extracting the interactive element instead.

  6. In Client Components that receive params or searchParams props, check that they are unwrapped with use() from React, not accessed directly:

    • const { slug } = use(params)
    • const { slug } = params ❌ (params is a Promise in Next.js 15)
    • Flag any Client Component that destructures params/searchParams without use() or await

Output format:

  • List each component with its status: ✅ CORRECT, ⚠️ UNNECESSARY 'use client', or ❌ MISSING REQUIRED 'use client'
  • For each issue, show the specific lines causing the classification
  • Provide a concrete refactor suggestion for each problem found
  • End with a summary: X components reviewed, Y issues found, estimated server-rendering improvement

If no path is provided in $ARGUMENTS, analyze all components in the current directory and subdirectories.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 36 lines · 0 tokens per session scan A 984ea75393bf

Subscribe to this mod's changes

check-boundaries is a command published in the GitHub repository pruthvinathJV/nextjs-claude-code-kit (2 stars, last pushed 6mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 482 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.